This is straight-forward with WMI. There might be a canned user-defined function for this - that returns an array, maybe WMIQuery not sure, but here's code to get you started. This script dumps-out all the running processes on the workstation - and hi-lites any that have "explore" as part of its name ...

 Code:
Break on

$WMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" + @WKSTA + "\root\cimv2")

$Processes = $WMI.ExecQuery("Select * FROM Win32_Process")

For Each $Process in $Processes

 If InStr($Process.Name,"Explore")

  color g+/n

 Endif

 ? $Process.Name

 color w/n

Next